Calling a WCF from ASP.NET with same the single-signon user LogonUserIdentity

Question

I have a ASP.NET MVC page, which call WCF logic.

The system is single-signon using NTML. Both the ASP page and the WCF will use the UserIdentity to get user login information.

Other then NTML, I will also have a Form based authorization (with AD) in same system.

The ASP page, is it simple and I can have it from HttpContext.Current.Request.LogonUserIdentity.

However, it seem it is missing from the WCF which call by the ASP, not from browser.

How to configure to pass the ID pass from the ASP to the WCF?

Answer 1

It sounds to me like you need to perform 'Impersonation' of the original user which will allow you to pass on the original caller's identity to the WCF service.

See this guide: Impersonation and Delegation in WCF

Although you have configured ASP.NET to authenticate your callers via NTLM, the worker process is still running with a machine identity (depending on your configuration in IIS). You would need to explicitly impersonate the caller by having the process adopt the callers identity, perhaps just temporarily.

UPDATE: see also Delegation - WCF Gotcha #2

If you want to avoid impersonation anothe option is to use the IdentityModel and a WindowsClaimSet